WordPress has released WordPress 7.0.4, a security update that fixes a high-severity remote code execution vulnerability affecting certain WordPress websites.
If your business website runs on WordPress, this is an update you should not ignore.
WordPress recommends updating immediately because the vulnerability could allow an authenticated user with sufficient permissions to upload a malicious file and potentially execute code on affected servers.
What Is the WordPress 7.0.4 Security Update?
WordPress 7.0.4 was released on August 12, 2026 specifically with a security fix.
According to the official WordPress security announcement, the vulnerability involves authenticated remote code execution through a malicious file upload on WordPress installations using Imagick and Ghostscript.
The vulnerability is tracked as:
CVE: CVE-2026-65640
GitHub Security Advisory: GHSA-8vr3-7mxf-gx8w
Severity: High
CVSS Score: 8.8/10
WordPress has already patched the issue in version 7.0.4.
What Is the WordPress Vulnerability?
The security issue can affect certain WordPress installations where Imagick and Ghostscript are being used on the server.
An attacker would also need to have an account with the ability to upload files. According to the official advisory, this generally means an authenticated Author-level user or another user with the upload_files capability.
The vulnerability involves malicious PostScript files being processed in an unsafe way.
In simple terms, under the right conditions, a malicious user who already has access to a WordPress account could upload a specially prepared file that may cause the server to execute unauthorized code.
That could potentially put website data, website integrity, and server availability at risk.
Is Every WordPress Website Vulnerable?
No.
There are specific requirements for this vulnerability to be exploitable.
According to the WordPress security advisory, an affected environment requires:
- Imagick and Ghostscript to be in use on the server.
- The attacker to have a WordPress account with the ability to upload files.
- A vulnerable version of WordPress to be installed.
However, business owners should not use those requirements as a reason to delay the update.
Most website owners do not know exactly how their hosting server processes images or which server-level packages their hosting provider uses.
Updating WordPress is therefore the safest approach.
Which WordPress Versions Are Affected?
The advisory lists multiple affected WordPress branches, including versions from WordPress 4.7 through WordPress 7.0.3.
For the current WordPress 7.0 branch, versions:
7.0.0 through 7.0.3
are affected, while:
WordPress 7.0.4
contains the security fix.
WordPress has also backported the security fix to older branches as a courtesy to users running older installations. However, WordPress emphasizes that only the most recent version is actively supported.
For businesses, staying on an outdated WordPress version for long periods can create unnecessary security and compatibility risks.
How to Update to WordPress 7.0.4
Updating WordPress is straightforward for most websites.
Log in to your WordPress admin dashboard and go to:
Dashboard → Updates
Then select:
Update Now
WordPress also supports automatic background updates on eligible websites, and supported installations may update automatically.
However, business owners should still verify the installed WordPress version rather than assuming the automatic update has already happened.
After updating, confirm that your website is running:
WordPress 7.0.4
or an appropriate patched version for the WordPress branch being used.
Back Up Your Website Before Updating
Even when an update is security-related, creating a backup first is a good website maintenance practice.
A backup should ideally include:
- WordPress files
- Themes
- Plugins
- Uploaded media
- Website database
- Important configuration files
For actively maintained websites, backups should already be part of the website’s regular maintenance and security process.
After the backup is complete, apply the security update and test the important parts of the website.
What Should You Check After Updating WordPress?
Updating WordPress itself is only part of the process.
After installing WordPress 7.0.4, check that the website still works correctly.
Test important areas such as:
Website Pages
Open the homepage, service pages, blog posts, landing pages, and other important pages.
Contact Forms
Submit a test message to confirm forms are still being delivered properly.
Ecommerce Websites
If the website uses WooCommerce, test products, carts, checkout pages, customer accounts, and payment integrations.
Booking Websites
Test the booking process from beginning to end.
Plugins and Themes
Check for PHP errors, layout problems, plugin conflicts, or unexpected warnings.
Mobile Website
Review the website on both desktop and mobile devices.
Website Performance
Check whether the update caused any noticeable performance changes.
A security update should protect the website without damaging the customer experience.
Why WordPress Security Updates Matter for Businesses
A business website is more than a group of webpages.
It can contain:
- Customer information
- Contact form submissions
- User accounts
- Ecommerce orders
- Payment integrations
- Booking information
- Business email integrations
- Analytics systems
- CRM integrations
- API connections
- Administrative accounts
A security problem can therefore affect much more than the website’s appearance.
Depending on the website and vulnerability involved, a compromised website could potentially lead to unauthorized changes, malware, customer trust problems, search engine warnings, downtime, or loss of business information.
That is why security updates should be treated as part of normal website operations rather than optional technical maintenance.
Does Your Website Automatically Update WordPress?
Some WordPress installations receive automatic security updates, but automatic updates should not replace active website management.
A website should still be regularly checked for:
- WordPress core updates
- Plugin updates
- Theme updates
- PHP compatibility
- Security vulnerabilities
- Failed backups
- Broken functionality
- Malware
- Unauthorized administrator accounts
- Server configuration problems
A website can appear completely normal to visitors while still running outdated software behind the scenes.
WordPress Website Maintenance Should Be Ongoing
This WordPress 7.0.4 security release is another reminder that launching a website is not the end of website management.
WordPress websites depend on several constantly changing components, including WordPress core, plugins, themes, PHP versions, hosting environments, databases, APIs, and third-party integrations.
Keeping those systems maintained helps reduce security risks and keeps the website reliable for customers.
For businesses that depend on their websites for leads, bookings, ecommerce, customer communication, or day-to-day operations, ongoing WordPress website maintenance and security monitoring should be part of the overall digital strategy.
What WordPress Site Owners Should Do Now
If your website runs WordPress, take the following actions:
- Check your current WordPress version.
- Create or confirm a recent website backup.
- Update to WordPress 7.0.4 or the appropriate patched version.
- Update outdated plugins and themes where appropriate.
- Test the website after updating.
- Review administrator, editor, and author accounts.
- Remove accounts that no longer require access.
- Confirm that regular backups and security monitoring are working.
The most important action is simple: do not leave a vulnerable WordPress installation unpatched.
Need Help Updating or Securing a WordPress Website?
Business owners who are unsure whether their WordPress website is affected should have the installation, plugins, themes, hosting environment, backups, and user access reviewed.
Supreme Line provides WordPress website development, website maintenance, security updates, troubleshooting, performance optimization, hosting support, website backups, and ongoing website support for businesses.
A properly maintained WordPress website should not only look professional. It should remain secure, updated, fast, and dependable as the software behind it continues to change.
Frequently Asked Questions
What is WordPress 7.0.4?
WordPress 7.0.4 is a security release published on August 12, 2026. It includes a fix for a high-severity authenticated remote code execution vulnerability affecting certain WordPress installations.
Should I update to WordPress 7.0.4?
Yes. WordPress recommends that site owners update immediately because version 7.0.4 contains an important security fix.
What vulnerability does WordPress 7.0.4 fix?
WordPress 7.0.4 fixes CVE-2026-65640, an authenticated remote code execution vulnerability involving malicious file uploads on certain sites using Imagick and Ghostscript.
How serious is CVE-2026-65640?
The official security advisory rates the vulnerability as High severity, with a CVSS score of 8.8 out of 10.
Can an anonymous website visitor exploit the vulnerability?
The published advisory describes the vulnerability as requiring an authenticated user with the ability to upload files, such as an Author-level account or another account with the upload_files capability.
How do I update WordPress?
Log in to WordPress and navigate to Dashboard → Updates → Update Now. Eligible websites may also receive the security update automatically through WordPress background updates.
Should I back up my website before updating WordPress?
Yes. Creating a recent backup before applying WordPress core, theme, or plugin updates provides a recovery option if a compatibility problem occurs.
What should I do if I cannot update my WordPress website?
If an update fails or causes errors, avoid leaving the website on a vulnerable version. A WordPress developer or website maintenance provider can investigate plugin conflicts, PHP compatibility, hosting configurations, database issues, or other problems preventing the update.
Source: WordPress.org Security and Release Announcement, August 12, 2026. Security details are also documented under CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w.
